obsidianforensics / hindsight

Web browser forensics for Google Chrome/Chromium
https://dfir.blog/hindsight/
Apache License 2.0
1.06k stars 140 forks source link

Parse "Cache records" is slower compared to Nirsoft ChromeCacheView.exe #160

Closed snowman closed 7 months ago

snowman commented 7 months ago
Cache records:            [   5650 ]
---
Cost time: 12.328316450119019

while ChromeCacheView.exe takes 1 second

snowman commented 7 months ago

comment out data parser in file chrome.py make cost time reduce to 0.7346768379211426, credit to cProfile and ChatGPT :tada::tada:

         self.data = []
#        for index in range(4):
#            addr = struct.unpack('I', block.read(4))[0]
#            try:
#                addr = CacheAddress(addr, address.path)
#                self.data.append(CacheData(addr, dataSize[index], True))
#            except CacheAddressError:
#                pass